8ca40a5c087a5661_2648_1344397637447142112023

Sharing

Copy URL

Twitter E-mail

General

Target

8ca40a5c087a5661_2648_1344397637447142112023
Size

92KB
MD5

41b982df0d4de9ceead929469ddb32b5
SHA1

1884ed4fee1441763ee7c73ee732185c2f2cd286
SHA256

8ca40a5c087a5661e683f6cbbdcdb8356447e2ccefcf6809c3ec4a43b1f9abaf
SHA512

4d2311314767b93b3f31d6544903d1d34d69b6927728932dbf084b0581ce1a623d1a93c4bd60ab8b718a15865ade738875e12de1e80d527a53372c3caeaf6d9a
SSDEEP

1536:BTc+o5AWs3WMtWI3gSNjXTDP5aWtXxQnbH8ORcGN8uWyWebXtfh:C+GAWs38I3gWnP5HUJCGNFWeDtfh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ca40a5c087a5661_2648_1344397637447142112023

Files

8ca40a5c087a5661_2648_1344397637447142112023
.dll windows:10 windows x86

171d1ea50a24eb69b0039d5d15fb9236

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

memcmp
_unlock
_lock
_initterm
malloc
free
_amsg_exit
wcsncpy_s
_wcsicmp
_wcsnicmp
wcsstr
wcsncmp
wcstok_s
wcschr
toupper
_onexit
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memmove
??1type_info@@UAE@XZ
_XcptFilter
wcsrchr
wcsnlen
_purecall
??3@YAXPAX@Z
memcpy_s
__CxxFrameHandler3
_callnewh
__dllonexit
_vsnwprintf
_except_handler4_common
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
LoadStringW
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExA
LoadStringA
GetModuleHandleExW
LockResource
LoadResource
FindResourceExW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ReleaseSemaphore
WaitForSingleObjectEx
OpenSemaphoreW
CreateSemaphoreExW
CreateMutexExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
InitializeSRWLock

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventProviderEnabled

api-ms-win-core-processthreads-l1-1-0

TlsSetValue
TlsGetValue
GetCurrentThreadId
TlsFree
TlsAlloc
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
OpenThreadToken
TerminateProcess
GetCurrentThread

api-ms-win-core-localization-l1-2-0

IdnToAscii
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalFree
LocalAlloc
GlobalFree

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringLen
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-security-base-l1-1-0

CopySid
GetLengthSid
IsValidSid
GetTokenInformation

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock
GlobalSize

ntdll

RtlCopyUnicodeString
RtlAllocateHeap
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
NtUpdateWnfStateData
RtlNtStatusToDosErrorNoTeb
ZwQueryWnfStateData
RtlCompareUnicodeString
RtlFreeHeap
NtQueryWnfStateData
RtlNtStatusToDosError
NtQuerySecurityAttributesToken
RtlInitUnicodeString

rpcrt4

UuidFromStringW

oleaut32

SysFreeString

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey
RegOpenCurrentUser

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

EdpAddAppClipboardConsentInCache
EdpAuditAction
EdpCanCallerAccessWin32Clipboard
EdpCheckAccess
EdpCheckAccessForContext
EdpCheckIsDpapiNgEntId
EdpCheckIsRmsEntId
EdpClearClipboardMetaData
EdpConvertProtectorToExternalId
EdpFreeContext
EdpGetAppLockerUniqueAppIdentifier
EdpGetAppLockerUniqueAppIdentifierByToken
EdpGetAppLockerUniqueAppIdentifierByTokenEx
EdpGetClipboardAccessDeniedData
EdpGetContextForBinaryPath
EdpGetContextForImpersonatedToken
EdpGetContextForPackageFullName
EdpGetContextForProcess
EdpGetContextForWindow
EdpGetDataInfoFromDataObject
EdpGetDataInfoFromWin32Clipboard
EdpGetEnterpriseIdForClipboard
EdpGetEnterpriseIdForDataObject
EdpGetEnterpriseIdForUIEnforcement
EdpGetEnterpriseIdForUIEnforcementFromProcess
EdpGetFilePathsForDataObject
EdpGetIsManaged
EdpGetPersonalEnterpriseIdString
EdpGetPrimaryIdentities
EdpGetPrimaryIdentityIfManaged
EdpGetSourceAppIdForClipboard
EdpGetSourceIsEnlightenedForClipboard
EdpGetWindowFromThreadId
EdpIsAppClipboardConsentCached
EdpIsContextExemptOrEnlightenedAllowed
EdpIsFileAccessAllowed
EdpIsUIPolicyEvaluationEnabledForThread
EdpIsValidSubjectForEncryption
EdpRequestAccess
EdpRequestAccessForContext
EdpSetEnterpriseIdForClipboard
EdpSetSourceAppIdForClipboard
EdpSetSourceIsEnlightenedForClipboard
EdpShouldShowEnterpriseIndicator
EdpUtilCreateEnterpriseContextFromEnterpriseId
EdpUtilFreeEnterpriseContext
EdpUtilGetEnterpriseContextByName
EdpUtilGetEnterpriseContextByProcess
EdpUtilGetEnterpriseContextByWindowHandle
EdpUtilGetEnterpriseContextForCurrentView
EdpUtilGetEnterpriseContextForView
EdpUtilIsAppEnlightened
EdpUtilQueryPolicy
GetProcessUniqueIdFromToken

Sections

.text
Size: 79KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

171d1ea50a24eb69b0039d5d15fb9236

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

ntdll

rpcrt4

oleaut32

api-ms-win-core-registry-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 79KB - Virtual size: 80KB

.data Size: 512B - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 79KB - Virtual size: 80KB

.data
Size: 512B - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 3KB